Cyber Essentials Plus Test 1: the external vulnerability scan

What does Test 1 check?

Test 1 is a remote vulnerability scan of every public IP address your organisation uses, including IaaS, looking for internet-facing services with known weaknesses.

The first test case looks at your organisation from the outside. It simulates the opportunist attacker who scans the internet for services with known weaknesses, rather than a targeted adversary.

• Identify all of the IP addresses currently in use by the applicant. This must include IaaS where used.
• Scan all identified IP addresses on the recommended set of TCP and UDP ports.
• For each internet-accessible service discovered, use the flow diagram and notes to determine whether to record a pass or fail result for the service.

Which addresses are scanned?

Every address, not a sample. That includes office broadband and leased-line addresses, any public addresses at branch sites, the public side of VPN concentrators, and every IaaS instance with a public address (for example Azure virtual machines, AWS EC2 instances and cloud-hosted firewalls).

Where an internet connection uses a dynamic address, the specification allows the scope to be defined by DNS entries instead. The assessor is warned to take care that carrier-grade NAT does not send assessment traffic to the wrong destination, which is a practical reason to give the assessor accurate, current addresses.

Home workers on ISP routers are not scanned: those routers are out of scope under v3.3 and the firewall control is met by a software firewall on the device.

How is each service judged?

The specification gives the assessor a seven-step flow diagram (Figure 1, 'Sub-test flow diagram for assessing services accessible through the firewall') and the assessor records a pass or fail for each service. Test 1 passes only if every service passes.

The steps run in order. 1: does the service include vulnerabilities that score 7.0 or more (high risk)? Yes is a fail. 2: does it give access only to information that is both public and read only? Yes is a pass. 3: do users need to authenticate to access it? No is a fail. 4: is authentication based on two or more factors? Yes is a pass. 5: have default passwords for the service been changed? No is a fail. 6: does it throttle login attempts to defend against brute-force password guessing? Yes is a pass. 7: does it lock users out after at most 10 failed login attempts? Yes is a pass, No is a fail.

Step 1 comes first and has no exceptions in the diagram: a scored vulnerability of 7.0 or more on an exposed service fails it, whatever else is in place. The diagram tests the service, not your paperwork, so a service can pass Test 1 and still breach a requirement in the question set, for example a firewall admin page opened to the internet without the documented need A4.10 asks for.

How do you pass Test 1?

Most of the work is done in your own firewall rule review and patch cycle before the assessor arrives.

• List every public address and IaaS instance from A2.5 and check the list against your ISP contracts and cloud consoles.
• Run your own external scan on the same address list and fix every finding that scores 7.0 or more, whatever its age: step 1 of the flow diagram fails a service with any such vulnerability.
• Close every inbound rule without a documented business need, and record the need for the ones that stay (A4.8).
• Move firewall, router and hypervisor management off the internet, or put MFA or an IP allow list in front of it (A4.9 to A4.11).
• Update VPN, firewall and router firmware. Appliances are a common source of unpatched high-severity findings.
• Re-scan after fixes and keep the report. The assessor may ask how you manage the firewall (A4.5) and when the rules were last reviewed (A4.6).

How do assessors check this?